Abyssale vs Pixelixe

Abyssale 85

API version v2026-10-29, eight days before this check (30). Fifteen dated API versions between 21 August and 29 October, MCP server releases 1.0.0 (1 September) to 1.2.0 (7 October), and SDK releases in October (20). Closed service with a changelog and RSS feed, help@abyssale.com and in-app chat, which we didn't test (12 of 15). com.abyssale/mcp is in the official MCP registry under a domain-verified namespace, and the Node.js (1.9.0) and Python (1.7.0) SDKs were both released on 21 October 2026 (15). Both SDKs are current; their repositories weren't read (8 of 10). 30 + 20 + 12 + 15 + 8 = 85.

Pixelixe 19

No dated release or API change was found. The newest dated items are the MCP registry entry of 26 March 2026 and the privacy policy of 7 April 2026, more than 180 days before this check (0). No three dated changes since 8 August (0). No changelog. Support by email at inquiries@pixelixe.com, not tested (4 of 15). com.pixelixe/pixelixe-mcp is in the official MCP registry under a domain-verified namespace; there are no official SDKs (15). No public package or repository (0). 0 + 0 + 4 + 15 + 0 = 19.

Abyssale 85

20 MCP tools (15 for 11 to 30), plus 5 because OAuth scopes per tool group let a client be approved for reads only (20 of 25). Design listings search by words in any order, filter by project, orientation, size, format and dates, sort and order, and say honestly when a page is past the end; listing tools refuse unsupported options rather than ignore them, per MCP 1.2.0 (19 of 20). One envelope with an id to branch on, and error docs that say which errors a retry never fixes (19 of 20). The permissions page marks each tool read-only, mutating or destructive, but MCP annotations couldn't be confirmed on the closed server, and generation has no idempotency key (12 of 20). Official Node.js and Python SDKs with retry behaviour and polling helpers (15). 20 + 19 + 19 + 12 + 15 = 85.

Pixelixe 49

Seven compact MCP tools (25). Document and design-set search filters, with no pagination documented (10 of 20). All errors are 400 with free-text messages, so an agent can't branch on a code (6 of 20). No idempotency keys, and annotations couldn't be read on the closed server. The MCP tools only read and create, with nothing that deletes (5 of 20). Few required fields, but no official SDK (3 of 15). 25 + 10 + 6 + 5 + 3 = 49.

Abyssale 98

A 424 KB OpenAPI file at developers.abyssale.com/api.yaml with 34 operations, from which the reference pages are generated (25). A detailed llms.txt that states the base URL, auth, rate limits, error envelope and webhook signing up front (10). Pages say what each endpoint is for and when to use another, such as synchronous versus asynchronous generation and designs versus workspace templates, and the MCP permissions page says what each tool can break (19 of 20). Typed parameters with enums, ranges and required fields across layers and formats (14 of 15). One error envelope everywhere, an error catalogue with machine-readable ids and what to do for each, and worked examples (15). Date-based versions named in every response and a dated changelog in Keep a Changelog form with a Breaking section first; the MCP server has its own semver changelog (15). 25 + 10 + 19 + 14 + 15 + 15 = 98.

Pixelixe 66

OpenAPI 3.1 (version 2.0.0) at pixelixe.com/pixelixe-openapi.json, but it covers four endpoints, authentication, document search, graphic automation and photo effects, and leaves out the JSON-to-graphic and image processing APIs (18 of 25). llms.txt exists but routes readers to marketing pages; the MCP reference is written for LLMs (7 of 10). The MCP reference says what each of the seven tools maps to, that pixelixe_generate_graphic_variant 'is not a free-form layout API', lists common mistakes and how to present outputs (17 of 20). The MCP layer documents canonical field names and refuses legacy aliases; the REST modifications are open structures keyed by element name (10 of 15). Request examples throughout, but errors are one table of message strings all returning 400 (8 of 15). /v2 paths and a deprecated V1, with no changelog (6 of 15). 18 + 7 + 17 + 10 + 8 + 6 = 66.

Abyssale 71

Closed service under terms of service version 3 of 21 July 2026, from a Paris SAS with its register number (15). The privacy policy and terms agree on EU hosting on AWS Ireland, deletion timelines and breach notice within 72 hours, but AI model training on anonymised customer content is on by default with a workspace opt-out, and anonymised data may be kept indefinitely (20 of 30). The changelog has Deprecated and Removed sections and refers to a deprecation policy that covers stable endpoints but not alpha ones; the policy's notice period wasn't found (14 of 20). Subprocessors named with locations, among them AWS Ireland, Auth0, Brevo, Intercom and AI providers including OpenAI, Anthropic, Black Forest Labs and Google, some outside the EEA (20). 15 + 20 + 14 + 20 = 69.

Pixelixe 41

Closed service under terms of 19 March 2026 that choose French law but name no company (12 of 30). The privacy policy of 7 April 2026 keeps account data while the account is active and 'as long as reasonably necessary' after, with no periods, and says nothing about AI processing or training (10 of 30). V1 is marked deprecated in the docs with no dates or notice period (5 of 20). Processors are described only by category, with Google Analytics named, and data processed in France, the EEA and other vendor countries (5 of 20). 12 + 10 + 5 + 5 = 32.

Abyssale 41

Hosted lines, for the REST API and the remote MCP server. No status page was linked from the site or the docs, and status.abyssale.com did not answer (0). No readable incident history (5). Rate limits published in full, 10 requests a second globally and per-workspace tiers with per-minute and per-hour budgets (15). 429s carry Retry-After and X-RateLimit headers, three 429 ids say which limit was hit, failed generations cost nothing, and webhooks carry a delivery id to deduplicate on. No idempotency key on generation requests (13 of 15). The terms promise best-effort availability and leave SLAs to Enterprise contracts, so none is published (0). Generation and the MCP server are generally available, while Design Import, the JSON authoring route, is labelled alpha (8 of 10). 0 + 5 + 15 + 13 + 0 + 8 = 41.

Pixelixe 15

Hosted lines. No status page found on the site or in the docs (0). No readable incident history (5). No rate limit is published; the terms only forbid circumventing them (0). No 429, Retry-After or backoff guidance. Every error, a wrong key and exhausted credits included, is a 400 with a message (0). No SLA found; the terms supply the service as is (0). API v2 is current and not labelled beta (10). 0 + 5 + 0 + 0 + 0 + 10 = 15.

Abyssale 55

The MCP server uses OAuth through Auth0 with scopes per tool group (read:design, write:design, delete:design, import:design, generate:banner, read:credits and others), enforced alongside the user's workspace role, and approval is per client connection. The REST API uses a workspace x-api-key with no scopes documented (28 of 30). A client can be approved for reads only, and deleting needs its own scope, but nothing on the server asks for confirmation; the docs leave that to the client per the MCP spec (17 of 20). Tools return the workspace's own designs and fonts; image layers can point at outside URLs (10 of 15). No audit log or per-call record was found (0). No security.txt, disclosure policy, bug bounty or certification found (0). 28 + 17 + 10 + 0 + 0 = 55.

Pixelixe 38

A bearer API key per account, plus a public key for the embedded editor. The MCP server accepts the key or an OAuth token from studio.pixelixe.com/oauth/mcp with one pixelixe.mcp scope. No key scopes, rotation or revocation documented (18 of 30). No read-only mode, though the MCP tools can't delete or change account settings (10 of 20). Tools return the account's own templates and renders (10 of 15). No audit log or per-call record documented (0). No security.txt, disclosure policy, bug bounty or certification found (0). 18 + 10 + 10 + 0 + 0 = 38.